Privacy Policy

This policy explains what personal data StudyLess collects, why, who else processes it, how long we keep it, and what you can do about it. It covers the StudyLess apps for iOS and Android, the web app at app.studyless.app, this website (including its contact form), and the emails we send you. It is published in English and in Korean (한국어); the two say the same, and for users in South Korea the Korean text governs.

We wrote it to be read. If something here does not match what the product does, tell us at support@studyless.app and we will fix the product or the policy, whichever is wrong.

1. Who is responsible, and how to reach us

• Controller (the person responsible for your data): Mingeon Kim, an individual operating the service as "StudyLess", Seoul, Republic of Korea.
• Privacy officer (South Korea's Personal Information Protection Act): Mingeon Kim.
• Email for privacy requests and support: support@studyless.app

We have not appointed a Data Protection Officer under Article 37 GDPR, because our processing does not meet the conditions that require one, and we have not appointed an EU or UK representative under Article 27. Contact us directly at the address above.

The laws that most often apply to how we handle your data are the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, South Korea's PIPA and Japan's APPI. Section 3 lists the legal basis we rely on under each.

2. What we collect, and why

The list below follows what you do in the product. Everything in it is stored against your account ID, a random identifier created when your account is made.

Since October 25, 2026, StudyLess keeps your study in sets and materials. A set is a subject, class or course (what earlier versions called a folder); a material is one thing you added to it, with its own notes and cards (what earlier versions called a deck). Where this policy says deck, read material; where it says folder, read set. The phone app until it is updated still says decks and folders.

2.1 Creating and keeping an account

What:

• Your email address, and a password if you sign up with email. The password is stored only as a hash by our authentication provider; we never see it.
• If you use Sign in with Apple or Google: the identifier the provider gives us for you, the email it shares (for Apple this can be a private relay address), your name if the provider passes it on, and, from Google, the address of your Google profile picture. StudyLess shows that picture only to you, on your own screens, until you upload a photo or choose one of StudyLess's own icons (2.13).
• For Apple sign-in, an encrypted refresh token, kept only so we can disconnect your Apple ID from StudyLess when you delete your account, as Apple requires.
• Account timestamps, your language and appearance settings, and study preferences such as cards per round.
• Your answers to the two questions StudyLess asks when you start: what you are studying for and how you heard about StudyLess, each one tap from a short fixed list with an “Other” choice, and, if you heard about it on TikTok, Instagram or YouTube, which account (one from a short list, or “someone else”; kept in the acquisition record, 2.6a). What you study for sets the format and wording of your first set's practice tests; how you heard of us is used only to learn which channels bring students (2.6, 2.6a). The phone app until it is updated also asks when your next test is and when you like to study; those answers only fill in your first exam's date and your reminder time.

Why: to sign you in, keep your library the same on every device, and send account emails (password reset, email change). Earlier versions of StudyLess let you start as a guest; if you did, your data is tied to an anonymous account ID until you add an email or provider sign-in.

2.2 Study material and flashcards

What:

• The photos, PDFs, slides and documents, pasted text, recordings, lecture files and YouTube links you add, to a new material or to one you already have, with the file name, size and page count.
• The text of each source, page by page: a PDF's own text, the text our AI provider reads from each photo and scanned page, and the text you paste or record, kept with that source so Ask AI and the chat can answer from it (Section 5); and the flashcards generated from it.
• Key terms and formulas drawn from your material, with any edits you make to them.
• If you add a YouTube link: the video's address, its title and length, and its subtitles with their times, kept as the source's text; on Pro, for a video without subtitles, a transcript Supadata makes from its sound instead. To fetch them we send only the video's address to Supadata (Section 6); nothing about you goes with it.
• PowerPoint and Word files: before a material reads one, our own converter, which runs on Google Cloud in Singapore, turns it into a PDF in a temporary folder that is removed as soon as it answers. The PDF and your original file are kept as the source's files.
• 휴대폰으로 찍기 (the phone-photo link): on the web, a QR code opens a link on your phone, without the app or a sign-in, for ten minutes. The first phone that opens it claims it; others are refused. Each photo it sends (resized on the phone to about 1,600 pixels) is stored in your account's private storage and appears on the web. We keep only a one-way hash of the link. Photos you do not add to a material are deleted, with the link's records, a day after the link ends.
• Quizlet and Anki imports: your device reads the export file you choose and sends us its cards (and their pictures), which become a material with new schedules. Nothing is sent to Quizlet or Anki, and no AI runs unless you ask for notes, which then reads the cards as the material's source.
• When you add material to an existing one: a record of the addition (its sources, whether it was free, and how many sections of your notes it added or changed) and your notes as they were before it, so you can undo it.
• Source summaries: a summary our AI provider writes of each source file or recording on its own, kept with that source until you remove the source, its material or your account.
• Cards you write or edit yourself, and any images you attach to a card.
• Your sets: name, subject, description, colour and picture, who can see the set (only you, a class link, or the community; 2.15, 2.16), whether it is on Today, new cards a day, and when you archived it; the set's exams, each with its name, kind, date and time, length and the materials or units it covers, and the score you enter after it. Your materials: name and whether you or the AI gave it, kind, place in the set, when you archived it, its units, and its notes as one document you can edit, with the version it replaced and the version the AI first wrote, so a change can be undone. The days your plan's steps were done or moved, and the days a set's plan was completed.
• If you record a class (up to three hours, on the phone or in the browser): the audio, in 15-second parts, with the moments you mark while recording (★) and their times, which our AI provider transcribes (Section 6); the audio and its transcript are kept privately in your account until you delete the recording, its source or your account. The transcript is also a source of the material, with the notes, cards and memos written from it. Until a part has uploaded, it is kept on your device for your account only. On the phone or the web you can also upload a lecture file (audio or video) instead of recording; only its sound is uploaded, in one-minute parts. If you discard a recording whose words were already transcribed, a record of its length, with none of its content, stays until that month ends, to count the month's recording time.
• Live words, when they are on for your account: while you record a class, its sound also streams from your device to our speech service, Soniox, which sends back the words as they are spoken. We keep those words with the recording, with the tidied version our AI provider makes of them (paragraphs, headings, punctuation) and any memos it finds in them, until you delete the recording, its source or your account. To spell your subject's words right, Soniox also receives the recording's title, key terms from the notes of its material and of others in its set and, when a recording resumes, up to the last 500 characters of its words (Section 5.3). We keep a record of each live session (when, how long and which service), with none of its words, to count your plan's minutes.
• A recording picks up everyone who speaks in the room, so it can hold your teacher's and classmates' voices and what they say. Record only where your school and your teacher allow it (Terms, Section 5). Recordings and their transcripts are kept in your account only; a class link, an invite or the community never shows them (2.15, 2.16), though the notes and cards written from a class are shared with the rest of the set when you share it.
• Board photos: a photo of the board you take while recording is kept as a memo at that moment of the recording, in your account's private storage, until you delete the memo, its material, its set or your account.
• If you send a copy of a deck from the phone app until it is updated: an unlisted link, valid for 30 days until you stop it. Anyone who has it and signs in can see the deck's name, icon, colour, subject and number of cards, its first three card fronts and whether it has notes, and add their own copy of its cards and notes — never your reviews, your source files or your name. Pictures inside the cards are the exception: the copy links to the images stored in your account (see below), so the other person can open them for as long as those images exist. We count how many times a link was used.

Why: this is the product. Source files live in a storage folder that only your signed-in account can read. Extracted text and cards live in our database. A copy of your library is also kept on your device (and, in the web app, in your browser) so you can keep studying offline.

Images attached to cards are different. They are stored at long, unguessable web addresses that do not require a sign-in, so anyone who has the exact link can open them. Nothing in StudyLess lists or publishes those links, but please do not attach an image to a card that you would not want reachable that way. We are treating this as a gap to close, not a feature.

2.3 Reviews, scheduling and card games

What:

• Each answer you give a card (Forgot or Got it), when you gave it, and how long the card was on screen.
• The scheduling state the algorithm keeps per card (stability, difficulty, next due date) and the scheduler parameters kept for your account.
• Counters such as cards reviewed in total and your last study date.
• Card games (매칭, 블록): each finished game, with the set or material, your time or points, the number of cards and misses, and the day, so your own records show on any device. A game never changes a card's schedule or your streak.
• 퀴즈 배틀 (a live quiz with classmates, on the web): when you host one from your own set, we keep only its six-digit code, your set, a public key that lets players' phones tell the host's messages apart, and when it opened, for at most two hours. The game runs in your browser over a public real-time channel of our database provider named by the code: anyone who has the code can join with a nickname they type, signed in or not, and the channel carries the set's name, each question (a card's front with four cards' backs) and its answer, and every player's nickname, colour, score and rank. Each player's picks are encrypted so that only the host can read them. Nothing about the players is stored.

Why: to decide when each card comes back, adapt the schedule to an exam date when you set one, and show you what is due and what you have done. The scheduling section (Section 5) explains what the algorithm does with this.

2.4 Practice tests

What:

• The questions written for a material or a set, the question types, length and units you chose, and the step of an exam's plan it belongs to (a check or a practice exam), or that it is practice or a retry of the questions you missed.
• The answers you select or type, the score, each written answer's marks against its conditions and criteria (quoting your answer), and when you started and finished.
• A question you report (이 문제 신고): the reason you pick (a wrong answer key, two right answers, an odd question, or other) and an optional note. The question leaves your score, and we keep a copy of it as you saw it, with its paper and subject; we read these reports to fix what the test maker got wrong. A report is never shown to another student.
• If you answer a written question with a photo of your handwriting: the text read from it, which you check and correct before it is marked. The photo itself is not kept.
• 기출 참고: if you attach a past paper (up to eight photos or a PDF) as a model for a practice test, our AI provider reads its layout: each question's kind and marks, the time allowed, and how its questions are worded, with the topic words taken out. We keep that layout, with the name you give it, until you delete it or your account. The paper itself is not kept. We count the reads (ten a day) for two days.

Why: to run the test and show you the result. The material's notes, key terms and cards are sent to our AI provider to write the questions, a photo of a written answer to be read into text, and your written answers to be marked (Section 5). A practice test's result describes that attempt; it is not a prediction of an exam grade.

2.4a Notes, the chat, Ask AI and the Pro tools

What:

• Your notes (earlier called the deck summary): one document per material (a title, an overview, sections, key terms and a recap) kept with the material, with the previous version kept so a rewrite or an addition can be undone, the change you asked for when you last had them rewritten, and the number of cards and sources it was made from. If you choose “Listen”, the narration's script and its audio file, stored in your account's private storage.
• Your chats: several threads a set and several a material, each with a title (written from your first question until you rename it), whether you pinned it, and which materials it asks about; your questions (including those asked with “Explain” on a card), the replies, what each reply cited, the follow-up questions it offered, the 👍 or 👎 you gave it with your reason, any change to your cards or notes the chat suggested and whether you applied it, and a line for each notes rewrite you asked for. A thread is kept until you delete it, its set or material, or your account; it does not expire on its own.
• Photos in the chat: a photo you send, or an area of a page you mark, kept in your account's private storage (JPEG, PNG or WebP, up to 10 MB) until you delete its thread, its set or material, or your account. To answer, our AI provider reads the photo through a link that works for ten minutes.
• If a message reads as distress (by its words), the reply starts with crisis lines for your region (for example 109 and 1388 in Korea, 988 in the United States), free, whether or not the AI answers. To keep up to ten of those answers a day free of charge, we keep a record that one was given, with the day and none of the words, for up to a week.
• 서술형 첨삭: a written answer you send to be marked against your teacher's criteria, typed or as a photo of a page (read into text; the photo is not kept), with the task, the criteria, the marking and the text read from the photo, kept until you delete it or your account. The notes of up to three of your materials go with it to our AI provider, to mark it against what you studied.
• When you use “Ask AI” on a card during a review: the question you ask. A reply, like a chat answer, is kept for five minutes only, so that if your connection drops before it reaches you, asking again gets the same answer without using your allowance; nothing else of it is stored.
• Podcast episodes and short listens: the format, length and focus you chose, the script with its timings, and the audio file (MP3), stored in your account's private storage until you delete the episode or your account.
• Dictation, when live words are on: what you say into the chat's box streams to the speech service (5.3) and is written into the box for you to check and send. The sound is not kept, and only what you send is stored, as any message is. A record of each dictation's length, with none of its words, counts your daily minutes.

Why: to write, rewrite and narrate your notes, answer your questions about your material, and make podcast episodes. For the notes, the material's sources (text, photos, PDF pages and transcripts) and its cards are sent to our AI provider; for the chat, your question, the recent turns of the thread and the notes, source text and cards of the materials it asks about, with a photo you send, the photo; for Ask AI, the card's text, your question and the source text; for a podcast episode, the notes, sources and cards, and then the script to be voiced (Section 5). The microphone is used only while you record a class or dictate into the chat, and only after you allow it.

2.4b Exams, the plan and the 오답노트

What:

• For each exam you set up: its kind (midterm, final, quiz, mock test or other), its day, or for an exam period its timetable (each subject and its day); the goal score you choose, or that the exam is not scored; the question types; and when you set it up.
• Your real score, if you enter it after the exam, and when you entered it.
• The checks and practice exams in an exam's plan, with what 2.4 lists for every practice test, and which of them the exam has used.
• Recall from memory (백지복습): for each check, the unit of the notes, whether you typed it or photographed a page you wrote by hand, and the result: the unit's key points, which of them you covered (quoting your words) and, for a photo, the text it was read as. The photo is used for the check and not kept.
• Memos: the ones you write, and the ones written for you from your recordings, notes and material, each with its date if it has one, where it came from (a moment in a recording, a section of the notes or a page of a source) and whether you dismissed it.
• The 오답노트: each question you missed in a test, a check or a 첨삭, and each point a recall check found missing, kept as you missed it (its text, choices, answer, explanation and where it came from), with its set, material and unit, a note you add, the days you later answered it right, and when it left the list (after two right answers on different days, or when you marked it a slip); and each retry round (다시 풀기) with its questions and results. Kept until you delete it, its set or material, or your account. It never changes a card's schedule.

Why: to plan every day until the exam, to run its checks, recall checks and memos, and after the exam to show your goal beside the real score you entered. The scores you enter are shown only to you; analytics receives only a broad band of how a score compared with your goal (2.6), and neither is used for advertising. A plan, a check or a practice exam's score is not a prediction of your exam result. For a recall check, what you wrote (or its photo) and that unit's notes are sent to our AI provider; for memos, the notes, material and transcripts they are written from (Section 5).

2.5 Reminders and notification emails

What:

• Whether you turned reminders on, the time you chose, your device's time zone and language, and whether the operating system has granted notification permission.
• A push notification token for your device, stored with the platform and your reminder settings.
• Study reminder emails, while switched on: if no phone of yours shows our reminders, one email through Resend to your account email on a day you have cards due and have not opened StudyLess (the number of cards, about how long they take, and your next test's deck name and days left), stopping after a week without opening the app; Settings or the email's unsubscribe link turns them off. We keep when the app was last open, your time zone, language, reminder time, pace and new-cards-a-day setting, whether a phone shows our reminders, when we last emailed you and whether you turned them off.
• Your notification settings: which ones you want (study reminders; exam-day reminders, off until you turn them on; memo reminders; the weekly recap; and class prompts, off until you turn them on), quiet hours, the time you chose for the day's reminder and for an exam morning's, and your answers when the app asked whether to turn one on.
• What that day's one study email can say instead of the cards due: the next step of your plan and its minutes; an exam 14, 7 or 1 days away; a practice exam planned for that day; that a test has just passed; a memo dated two days ahead; or, on a Monday, that your free uploads are back. On an exam's day it is sent at the exam morning's time, and only if you turned exam-day reminders on. It follows the same rule as the study reminder email above, and there is never more than one a day.
• Other emails, each through Resend to your account email while it is switched on, at your local time and never in quiet hours unless you chose that time: the weekly recap on Sunday evening after a week you studied (the days you studied, your minutes, reviews, plan steps and tests, each set's minutes and cards, and your next exams with the days left); one email after a week without opening StudyLess saying reminders are paused, and while they are paused, at most one email for each exam in the next two weeks; and, for a class you turned it on for, a prompt to record it as it starts (the class's and its set's names and the time), unless a phone of yours already says it. Each email has an unsubscribe link for its kind, and Settings turns each one off.
• A record of each notification we decided on for you: its kind, which wording it used, the day, whether it was sent and how, and whether you opened the app from it. It keeps the same email from going twice.
• The phone app also reminds you on the device, five minutes before a class you asked to be prompted for and on an exam's morning; it tells our server when it last did, so the same class is not emailed as well.
• After an exam, your answer to one question in the app, “Did StudyLess help you feel more prepared for your test?” (yes, no or not sure), with the exam it was about.

Why: the daily reminder is scheduled on your device. The push token exists so that we can also send reminders from our server through Apple's and Google's push services (via Expo) when your device has not opened the app; that server-sent channel is currently switched off, and we will keep this policy current if we turn it on. Reminder text contains counts of due cards, never the content of a card. Turning reminders off in Settings stops both channels.

The emails above are scheduled on our server at your local time, read from the time zone on your profile (2.13).

2.6 How the app is used (product analytics)

What:

• Events such as app opened, screen viewed, set or material created, cards generated or saved, review session started and ended, number of cards rated, practice test started and finished (with its step and score), an exam set up (its kind, how far ahead it is and its question types; never its date, its subjects or your goal), its plan shown and a step of it opened, material added, a memo saved or dismissed, a recall check (how many key points it covered, never the text), a recording finished, whether you entered a real score after an exam and, in broad bands, how it compared with your goal (never either number), settings changed, feedback sent, and account deleted (with the reason you picked from a list).
• With each event: your account ID, platform, app version and build, language, whether the account is a guest, your plan (Free, Pro or a trial), and the device model and operating system version the analytics library reads.
• In the web app, the campaign tags of the link you arrived through (utm_source, utm_medium, utm_campaign and the like), which the analytics library adds to events. It is set not to record the page address, the referring page or advertising click identifiers.
• If you open a class link, or join a 퀴즈 배틀, in the browser without an account, the web app records the same kind of events (for example, that the shared set was viewed, with its number of cards) under a random identifier, with the approximate location Mixpanel derives from your IP address. They are linked to an account only if you then sign up.
• A profile per account with counts, flags and a few answers: platform, language, sign-in method, number of sets, materials and cards, how many have an exam date and how many days until the nearest one, whether you have created cards or completed a review and how long ago your first cards were made, your reminder and notification settings, your appearance setting, your plan and where it came from, your answers to the questions about what you study for and how you heard about StudyLess (2.1), and, where known, the campaign tags of the link you first came through (on Android, from Google Play's install referrer).
• Copies of the App Store and Google Play subscription events in 2.12, keyed to your account ID: RevenueCat sends them to our Mixpanel project for us, and our server records when Pro starts, there or on the web (a trial or a paid subscription, its billing period and the platform), and sets your plan on the profile. These are sent from the servers, not your device, so the switch below does not stop them.
• From our server, one event each time it sends you a notification email: its kind and that it was an email, keyed to your account ID, never its words and without your IP address. Like the subscription events, the switch below does not stop it.
• Your IP address at the moment an event is sent, which Mixpanel uses to derive an approximate location (city or region), and a random device identifier the analytics library creates.
• On mobile, Mixpanel's own app-lifecycle events (first open, app updated, session start).

What is deliberately not sent: your email, your name, the text of any card or the name of a set or material, search terms, file names, or the content of feedback. The analytics code rejects those property names and scans values for anything that looks like an email address, a token or free text before an event leaves the device. Session replay and click recording are off on every platform.

Why: to see where students get stuck (for example, how many people who sign up ever make a first set) and whether a release made things better or worse. You can turn this off in the app's settings: Settings → Share usage analytics. The switch is remembered per device and stops events before they leave it; crash reports (2.7) are separate. To have the analytics data already collected deleted, email us (Section 10).

2.6a How you found StudyLess (the acquisition record)

What:

• Written when you sign in and stored with your account (not at Mixpanel): the platform you started on; the campaign tags (source, medium, campaign) of the link you came through, read from the web address in the web app or from Google Play's install referrer on Android, and where they came from; the account you named under “Which account?” (2.1); and your device's language and time zone.
• The first value of each is kept and never overwritten. The record is included in your export and deleted with your account.

Why: to learn which links, videos and creators bring students to StudyLess.

2.7 Errors and crashes

What:

• The error, a stack trace, app version and build, device model and operating system, the screens visited before the error, and your account ID.
• On mobile, a random installation identifier so Sentry can count crash-free sessions per release.

Why: to reproduce and fix bugs. Request bodies, headers, cookies, email addresses and names are stripped before a report is sent, the report is not tagged with your IP address, and session replay is off.

2.8 Support and feedback

What:

• From the in-app feedback form: the kind you pick (bug, idea, question or other), your message, where it happened (filled in with the place you had open, such as the set and material, which you can change), for a bug what you expected, an optional name, a screenshot of the screen you were on (taken as the form opens and shown in it; you can remove it), whether you want a reply and the address to reply to, the app version, and your account ID and account email. The web app also adds, without asking, the page's address without its query, your browser's description (user agent) and the ID of the last error report from your session (2.7), so we can find what went wrong.
• From the website contact form: the category, your message, the name and email you enter, and an optional screenshot.
• Emails you send to support@studyless.app.

Why: to answer you and fix what you reported. Screenshots are stored where only we can open them.

2.9 Technical, security and usage records

• Server logs kept for a short time by our hosting providers: IP address, request time, endpoint, and result code.
• Rate-limit ledgers: the times your account made an AI request and started each metered use (an upload, an addition to a material, notes, a practice test, a recall or answer check, a chat message, a 첨삭, a podcast episode or short listen, a recording, a YouTube lookup), kept for the window each one enforces (Section 8), and how many times each written answer of a practice test was read from a photo.
• An AI usage ledger per model call: model, timing, token counts, outcome or error category, and provider request IDs. It does not contain your material or the cards.

Why: to keep the service running, to stop abuse, and to know what the AI features cost. Allowances depend on your plan; these records only enforce them.

2.10 This website

studyless.app uses Vercel Web Analytics and Speed Insights, which record page views, the referring site, country or region, device and browser type, and page performance. Vercel describes this as cookieless and does not use it to follow you across other sites. The website sets no advertising or tracking cookies. The contact form is described in 2.8.

2.11 Data from features we removed

Versions of StudyLess before 2.0 (August 2026) had study streaks with a daily goal, a public deck library where you could publish a deck under a display name and username, an onboarding question about how you found the app, and billing scaffolding that never charged anyone. The current apps do not use the data those versions collected (the old streak records, the old display name, username and avatar, and the old library's saves, reports and blocks); rows that already exist stay in our database until a cleanup migration removes them, and they are deleted with your account. StudyLess again asks how you heard about it (2.1), sells a subscription (2.12) and, since October 25, 2026, has a streak, a profile with an avatar, and a community where you can publish a set, all built anew (2.13, 2.16) and none of them reusing that old data. Answer checks, where AI checked an answer you typed or spoke during a review, have also been removed; the current apps no longer send review answers for checking, and use the microphone only while you record a class or dictate (2.4a).

The current apps no longer make visual overviews (October 2026). An older version of the app can still ask for one until it is updated: the notes are sent to our AI provider to draw it, and asking again replaces it. Ones made before stay readable with their notes until you delete the material or your account.

One consequence needs saying plainly: decks that were published to the old public library are no longer shown anywhere in StudyLess and can no longer be read without a StudyLess sign-in, but until that cleanup completes a signed-in user of an older app version who knows the deck's identifier could still retrieve its cards and the display name it was published under. Deleting the deck from your library removes it immediately; you can also email us to have it removed.

2.12 Subscriptions (StudyLess Pro)

What:

• Your plan (free or Pro), whether it is a paid subscription or a trial, when it expires and where it came from (a store purchase, a purchase on the web, an earlier invite reward or a grant we made), stored on your account, with a record of any Pro days granted outside a store purchase.
• Subscription events the store reports to us through RevenueCat: the product bought, the period, whether it is a trial, purchase and expiry dates, the store, and RevenueCat's own event and customer identifiers. We keep each event as received until you delete your account.
• For Pro bought on the web: each Dodo Payments subscription's ID, Dodo's customer ID, the product, its status, its billing dates and whether it is set to cancel, and each subscription event Dodo sends us, kept with the store events above until you delete your account.
• Billing emails, while each is switched on: your account email goes to Resend to send one reminder three days before a free trial ends (on any store or on the web), one notice about 30 days before a yearly plan renews (with the date, the price, how to cancel, and two counts from your account: the materials you made and the cards you reviewed in the past 12 months), and one notice when a payment fails (Section 6). We record when each was sent.
• If you take the seven more free days the cancel screen offers on a trial: when, through which store, and the day they run to; for Google Play, also a one-way hash of the store's purchase token (never the token itself), so the days are given once.
• If you took part in the invite programme, which is no longer offered: your invite code, the accounts it brought in and the days of Pro each side received.
• If you made a payment link for someone else to pay (“Someone else paying?”, offered while Pro is sold on the web): a random link code tied to your account, when it was made and when it stops working (14 days). Anyone holding the link can see whether your account has Pro and can buy Pro for it; the page shows no name, email or study data. The person paying enters their own email at checkout, and the receipts go to them. Deleted with your account and never included in exports.

What we never see: your card number or payment details. Pro is bought in the iPhone and Android apps, where Apple or Google handle payment, or on the web, where the payer enters payment details on Dodo Payments' checkout; we receive only the subscription records above.

Pro bought on the web is sold by Dodo Payments as the merchant of record: it bills the payment, appears on the statement, calculates and collects sales tax or VAT, and sends the receipt and invoice emails and its own email about two days before a trial's first charge. At checkout we give Dodo your account email (filled in for you), your name when we know it, and in the checkout's details your account ID, the plan with the price shown, the screen it was bought from and whether the student or someone else is paying, and your billing country.

Why: to give a paid account what it paid for, to honour Pro days from earlier invite rewards and grants, and to answer questions about a subscription. These records are deleted with your account. Apple, Google and Dodo Payments keep their own records of your purchases as the sellers, under their own policies (Section 9).

2.13 Your profile, friends, XP and leaderboards

What:

• Your profile: a nickname (made for you at sign-up from two words and three digits, never your name; you can change it, and no two accounts share one, whatever the case); a preset avatar (one of twelve icons); and, if you upload one, a profile photo (JPEG, PNG or WebP, up to 5 MB), kept in a private storage folder. Also whether your own screens show your Google photo, who can find and see your profile (nobody, friends, which is the default, or everyone), your time zone, which sets when your study day starts (4 a.m. local time) and when emails arrive, and the minutes you want to study on each weekday, which size your plan.
• XP and your level: one record for each thing that earned XP (reviewing or learning cards, finishing the day's work, a plan step, a check, a recall check, a practice test, a recorded class, a focus block on the timer, practice, a classmate starting to study a set you shared, a friend you invited studying on three days), with its amount and day; your total, your level and this week's XP. Only our server writes them, from study it can check.
• Your streak: the days you studied, and the past days with nothing due and nothing planned, which neither count nor break it; your current and longest streak, and how many days the server saw you study.
• The study timer: each focus block you finish (when it started and ended, the minutes you focused, the set if you picked one, stopwatch or timer, and the minutes you planned).
• Friends: the requests you send and receive and the friendships you accept; your invite links, and who joined through whose link and when they had studied on three days (which earns both of you XP, never Pro days).
• Blocks: the accounts you blocked.
• Reports of an account, from a leaderboard or your friends list: the account, the reason you chose (nickname, harassment, cheating or other), where you reported it and when. At most ten a day.
• Whether you joined the everyone leaderboards (from level 3, after three days of study).

What other students see, only through the app's own views:

• Someone who types your exact nickname (to send a friend request or invite you to a set) sees your nickname, level and preset avatar, unless your profile is set to nobody. Profiles cannot be browsed or searched.
• Your friends see your nickname, level and preset avatar, your photo if you chose to show it to friends, and on the friends leaderboards your XP this week, your current streak, your longest streak and your level.
• If you join the everyone leaderboards (from level 3, after three days of study), which sets your profile to everyone, every signed-in student can see your row there: your nickname, preset avatar, level and the board's number. The boards show the top 50 and your own place, never a bottom list.
• No one sees your email, your real name, your Google photo, your study material or your schedule through any of this. A block ends any friendship or request between you, takes each of you off the other's leaderboards and community lists, and stops invites and shared sets between you. No one is told who blocked or reported them.

Why: so you can add friends and study alongside them, and see progress you actually made: XP and the streak count study done, and never change what is due. We (the operator) read reports to deal with offensive nicknames, harassment or cheating.

2.14 Classes, the calendar and the calendar link

What:

• What you add to the calendar: classes (the name, the set they belong to, the days of the week, start and end times, the time zone, an optional place and weeks skipped), events and study blocks; the plan steps you move or mark done; and your to-dos.
• For each class, whether to prompt you to record it when it starts (off until you turn it on for that class; 2.5).
• If you turn on “Add to my calendar”: a private calendar link (webcal). It carries your exams (name, kind, date and time), each day's plan for each set (the set's name and that day's steps, in words) and your study blocks, from two weeks back to about four months ahead (study blocks five weeks ahead). The app rewrites them when your plan changes. We keep only a one-way hash of the link's secret part, never the link itself, with its language and when it was made.

Why: to plan your days around your classes and exams, and to show your plan in the calendar app you already use.

The calendar link's limits: anyone who holds the link can read what it carries, without signing in, so keep it to yourself. Your calendar app (and, for a calendar on the web such as Google Calendar, its provider's servers) fetches the link on its own schedule and keeps what it fetched under its own policy. Making a new link stops the old one at once; turning it off deletes it and what it carries.

2.15 Sharing a set: class links and invites

What:

• A set's class link, or a link to one material of it: a random, unguessable link; whether it also shows the set's next exam (its name, kind and date), which you choose; when you made it and when you stopped it; and how many people opened it and how many added the set from it. A signed-in student's open is recorded once, with their account, so each counts once; an open without an account is counted once a day by keyed one-way hashes of the visitor's IP address and browser (never the address itself), cleared as later opens are counted. You see only the numbers.
• Invites: you can invite someone by nickname (2.13) or by email address. We keep the invite (the set, the account or the address you typed, its status and when it was answered) and send that person one email through Resend with the set's name, your nickname and a link. When you invite by nickname, you never see the address behind it. Twenty invites a day, and at most three a day to the same address; an invite to an address that asked for no more invites, or across a block, sends no email. Thirty days after an invite is sent, the address you typed is deleted: an unanswered invite then expires and goes, and an answered one keeps only the account that answered. Someone who accepts becomes a member: they can study the set without editing it and add it to their own sets. You see your members' nicknames and preset avatars and your pending invites (with the address you typed), and you can remove anyone.
• If someone added one of your sets to their own: that they added it, from which set, how (link, invite or community) and when they first studied it. You see only counts (adds, people studying, opens, members), never who.

What anyone holding a class link can read, signed in or not: the set's name, subject, description and picture; each material's name (only a name you or the AI gave it, never a file's name), its units' titles, its notes as text and headings (without pictures or links) and its cards' fronts and backs as text; the questions of your latest practice tests on each material, as the paper prints them (with each question's unit and section and the lead and tables it is printed with), leaving out a question built on a reading passage and one to be heard; each question's answer, explanation and, for a short or written answer, its model answer or marking criteria and points, which the page shows once a paper is handed in (it is marked in the visitor's browser, and their answers are not sent to us); and the next exam only if you chose to show it. It never shows your own answers, your score, your retry papers or an essay's model answer. Chat apps that fetch the link show a preview with the set's name, icon and colour, its numbers of cards and notes and, if you chose to show it, the next exam's name and day. A visitor without an account sees only that, and no AI runs for them. A link to one material shows that material alone.

What a class link, an invite or the community never shows: your source files and photos, recordings and their transcripts, card images, memos, chats, your reviews and schedule, your scores, and your name, email or account.

Adding a shared set: the person who adds it gets their own copy of its notes, units and cards, with fresh schedules, in a new set of theirs; no sources, memos, exams or history. The copy is theirs.

If you were invited by email and do not use StudyLess: we keep your address with the invite, so that you can accept it once signed in with that address, and we sent you that one email. Its link “세트 초대 그만 받기” stops further invites to your address; we then keep a keyed one-way hash of the address, never the address, so we can honour it. The address itself is deleted 30 days after the invite was sent; write to support@studyless.app to have it, or the hash, removed sooner.

Why: so classmates can study the same notes and cards.

2.16 The community

What:

• Publishing is off until you choose it for a set. It needs level 3, three days on which you studied, a nickname, a set with notes and at least 20 cards, and, the first time, your agreement to the community rules (Terms, Section 6.4) with the confirmation “I made these notes and cards, or have the right to share them”; we keep the rules' version you accepted and when.
• For each listing: its title, description, subject, grade, exams, textbook and language; what browsing and search read from the set (its counts of cards, materials and units, and its words: titles, units, headings and key terms); its status (being checked, listed, declined by the check, in review, hidden by you, or removed) with the check's result and the moderation reason; when it was published; and counts of views, adds, adds this week and students studying it this week. A listing you take down is kept, hidden, so you can publish it again, until you delete the set or your account.
• Views: when you open a listed set's page, we record once that you opened it, so each student counts once. Its publisher sees only the number.
• The publishers you block from a community page, so their sets stop showing for you.
• The automatic check, when you publish and again within the hour after a listed set's notes or cards change: it looks in each material's notes and cards for personal information (phone numbers, email addresses, resident registration numbers, card numbers, a messenger or social account given as a contact), for publisher and copyright marks (ISBNs, © notices, “all rights reserved”, “no copying” lines) and for notes copied wholesale from that material's own sources (60% or more of its longer lines found word for word in the sources' text we keep). It runs inside our database; nothing goes to a third party or to our AI provider. A set that does not pass is declined: you see what was found (personal information masked), and the set stays private, or shared by class link if it was.
• Reports: any signed-in student can report a listed set (copyright, personal information, inappropriate, harassment, spam or other, with optional details up to 1,000 characters). We keep the report, who made it, its reason, its details and how it was resolved. The publisher is not told who reported.
• Moderation: when three different students, each with an account at least three days old, have open reports on a listing, it goes into review and is hidden until a moderator restores it or takes it down (after a restore, only newer reports count). Moderators are people we (the operator) appoint. Each act (in review, taken down, restored, ban, ban lifted) is kept with its reason, its date, the moderator and their note; the publisher sees the act, its reason and its date, never who acted or the note. A listing taken down for copyright counts against its account unless it is later restored; three of them, or a ban, end publishing for the account, and a ban takes all of its listings down. The publisher can answer (Terms, Section 6.5).

What every signed-in StudyLess student sees of a listed set: the listing (title, description, subject, grade, exam and textbook tags) and the set's picture; your nickname, preset avatar and level (shown with your listings whatever your profile's setting); each material's name, units and outline of headings and how many cards it has; the first 12 cards on its page, and all its notes and cards when they open a material or add the set; your other listed sets; and the counts of adds and of students studying it this week (a count under 10 is not shown on the set's card in the community's lists). Adding the set gives them their own copy (2.15). The community's pages never show a set's practice tests, sources, recordings, memos or schedule, and they are not open without an account. A block hides each other's listings.

Why: so students can find sets made for their subject and exam, and so the community stays lawful and safe.

3. The legal basis for each use

• Your account, study material, cards, reviews, practice tests, exams and the plan, reminders and notification emails, support, your profile, friends and leaderboards, the calendar and its link, and sharing and the community (2.1–2.5, 2.8, 2.13–2.16): needed to provide the service you asked for, including the features you choose to turn on, such as the everyone leaderboards, a class link, an invite or publishing a set. GDPR/UK GDPR Art. 6(1)(b); LGPD Art. 7(V); PIPA Art. 15(1)(4) (necessary to perform the contract with you); CCPA/CPRA business purpose.
• Analytics, the acquisition record, error reports, security and usage records (2.6, 2.6a, 2.7, 2.9, 2.10): our legitimate interest in understanding, improving and protecting the service, weighed against your rights and limited as described above. GDPR/UK GDPR Art. 6(1)(f); LGPD Art. 7(IX); PIPA Art. 15(1)(6); CCPA/CPRA business purposes (analytics, debugging, security). You can object at any time (Section 10).
• Reports, moderation and takedown notices (2.4, 2.13, 2.16): our legal obligations to act on notices, and our legitimate interest in keeping StudyLess lawful, safe and correct. GDPR/UK GDPR Art. 6(1)(c) and (f); LGPD Art. 7(II) and (IX); PIPA Art. 15(1)(2) and (6).
• Other people's voices in a class you record (2.2): our legitimate interest in providing the recording you asked for, limited to keeping it in your private account and never showing it to anyone else. GDPR/UK GDPR Art. 6(1)(f); LGPD Art. 7(IX); PIPA Art. 15(1)(6).
• The week-long record of a free answer to a distress message (2.4a): protecting you, so that crisis lines and an answer reach you without cost; it holds no words and is used for nothing else. GDPR/UK GDPR Art. 6(1)(d) and (f); LGPD Art. 7(VII); PIPA Art. 15(1)(5).
• Mobile notifications: your choice in the app, plus the permission you grant to the operating system. Withdraw either at any time.
• Legal obligations and claims: where we must keep or disclose data to comply with the law or defend a claim. GDPR Art. 6(1)(c) and (f).

We do not sell personal data, share it for cross-context behavioural advertising, or use it to profile you for marketing. We do not process special categories of data on purpose; do not put health, religious, political or similar information about yourself or others into your cards.

4. Children and teenagers

StudyLess is made for students, and many of them are between 13 and 17. It is not for children under 13, and we do not knowingly create accounts for them. Where your country sets a higher age for using an online service without a parent's consent, that age applies: 14 in South Korea, and up to 16 in some EU countries. We do not currently have a way to collect a parent's consent, so users under those ages cannot use StudyLess.

Because minors use the product, we keep the rules in this policy tight for everyone: no advertising, no sale or sharing of data, no cross-app tracking, study material never used to train AI models, and analytics that cannot carry names, emails or card text.

If you believe a child under the applicable age has an account, email support@studyless.app and we will delete it. A parent or guardian may make any request in this policy on their child's behalf; we may ask for enough information to confirm the relationship.

5. AI features and automated scheduling

5.1 The AI features (OpenAI)

We use the OpenAI API, provided by OpenAI, L.L.C. (United States), to write your notes and add to them when you add material, to rewrite them when you ask, to turn your material into flashcards, to read the text of each photo and scanned page so Ask AI and the chat can answer from it, to draw out key terms and formulas, to sort each card under its unit of the notes, to write memos from your notes, material and recordings, to answer the chat and Ask AI, to read a photo you send in the chat, to write a summary of each source, to write an exam's checks and practice tests in its question types, to read a past paper's layout, to read a photo of a written answer into text and mark written answers against their conditions and criteria, to mark a 서술형 첨삭 against your teacher's criteria, to check a recall attempt against a unit's notes, to write podcast scripts and voice them, to narrate notes, to transcribe class recordings and files, and to tidy the live words of a recording and find memos in them. Here is exactly how that works:

• What is sent: the material the feature works from (your sources — photos, PDF pages, pasted text and transcripts, cut into parts when large — a material's notes and cards, your chat question with the recent turns of the thread and any photo you send, your written answers and the writing you send for a 첨삭, a photo of a written answer or of a page written for a recall check, a past paper you attach for 기출 참고, the text to be spoken for a podcast or narration, and the audio of a recording to be transcribed), and our instructions for the task. A random request ID is included so repeated parts of a request can be cached.
• What is not sent: your name, email address or account ID. Requests go from your device to our own server (from the web app, through the web app's server at Vercel, Section 6), which holds the API key and forwards the request; the key is never in the app.
• Storage at OpenAI: requests that write text (notes, cards, key terms, memos, chat and Ask AI replies, source summaries and source text, practice tests, photo answers, grading, recall checks, tidied live words and podcast scripts) are sent with storage disabled (store: false), so OpenAI does not keep them as retrievable conversation history. Requests to OpenAI's text-to-speech and transcription services (voices and narration, class transcripts) and its image service (a visual overview asked for in an older app version, 2.11), and the upload of larger files, carry no such setting. Larger files are uploaded to OpenAI only for the duration of a generation and deleted as soon as it finishes; an hourly job deletes any that were missed, so a file should never persist there beyond about an hour.
• Abuse monitoring: OpenAI states that it keeps abuse-monitoring logs of API usage for up to 30 days, longer only where the law requires it. That retention is OpenAI's, not ours, and store: false does not shorten it.
• Training: OpenAI states that data sent through its API is not used to train or improve its models unless the customer opts in. We have not opted in, and we do not train models of our own on your material.

Generated notes, cards, key terms, memos, answers, questions, grades, recall checks, summaries, podcasts and live words can be wrong, and so can the text read from a photo. Check them against your source, especially before an exam. If we ever change AI provider, we will update this policy before the change takes effect.

5.2 Review scheduling

StudyLess schedules reviews with a spaced-repetition algorithm (FSRS) that uses your ratings to estimate when you are likely to forget each card and, when a set has an exam date, adjusts the schedule so the material is due before the exam. It decides only the order and timing of your flashcards. An exam's plan works out from the exam's day, your cards and the minutes you chose which new cards to learn and which steps to take on which day; it never changes when a card is due. Practice-test grading is also automated. Neither produces legal or similarly significant effects about you, and neither claims to know whether you are ready for an exam.

5.3 Live words and dictation (Soniox)

When live words are on for your account, the words of a class you record appear as it is spoken, and you can dictate into the chat. Soniox, Inc. (United States) does this for us, as our processor.

• How: your device opens a direct, encrypted connection to Soniox with a key our server makes for that one session. The key works once, must be used within a minute and stops at the minutes your plan has left. The sound does not pass through our servers.
• What Soniox receives: the sound, as it is recorded; for a class, its title, key terms from the notes of its material and of others in its set and, when a recording resumes, up to the last 500 characters of its words; the languages to expect; and your device's IP address, as any connection carries. For dictation, only the sound and the languages. Not your name, email or account ID.
• What Soniox keeps: Soniox states that real-time requests are processed transiently and not stored, and that it does not use customer content to train, fine-tune or improve its models (Soniox Privacy Policy, updated June 29, 2026). It keeps usage records without the content, for billing.
• What we keep: the words (2.2) and a record of each session: when, how long and which service, with no words. Your recording is still saved in 15-second parts (2.2), and its transcript may be written from the live words or by our AI provider from the saved sound.

Live words can be wrong. Check them against the recording.

6. Who processes your data

We do not sell personal data and we have no advertising partners. The companies below process data for us, under contracts that restrict what they may do with it; Apple, Google and Dodo Payments also handle their part as sellers or sign-in providers under their own policies, as their entries say. For each one: where they are, where your data is kept, what they receive, why, and for how long.

Supabase, Inc. — United States company; our database, file storage and authentication run on its infrastructure in Amazon Web Services' Singapore region (ap-southeast-1).

• Data: everything in Sections 2.1–2.5, 2.6a, 2.8, 2.9 and 2.11–2.16: account and sign-in data, password hashes, encrypted Apple tokens, study material and extracted text, the text of each source, source summaries, notes, key terms and formulas, cards, sets and materials, exams and the scores you enter, memos and board photos, recall checks, the record of material added, chats and their photos, 첨삭, podcast episodes, narrations, visual overviews made before, review history, practice tests and the questions you report, past-paper layouts, the 오답노트, card game results, recordings and their live words, reminder and notification settings, the notification log and push tokens, your profile and profile photo, XP, study days and timer blocks, friends, blocks and reports, classes, the calendar and the calendar link's items, class links, invites and members, community listings and their reports, the acquisition record, feedback, ledgers, subscription records. A 퀴즈 배틀's questions and players' messages pass through its real-time channels without being stored (2.3).
• Purpose: storing and serving the product, sending authentication emails, running our server-side functions and real-time channels.
• When: continuously, as you use the app.
• Retention: until you delete the data or your account; backups expire within 30 days.

OpenAI, L.L.C. — United States.

• Data: the study material, notes, cards, chat questions and the photos sent in the chat, written answers and writing sent for a 첨삭, photos of written answers and of recall pages, past papers attached for 기출 참고, and text to be spoken described in 5.1, the audio of classes you record or upload (2.2), and the live words of a recording to be tidied.
• Purpose: writing, adding to and rewriting notes, generating flashcards, key terms, memos, source summaries, checks and practice tests, reading the text of photos and scanned pages, answering the chat and Ask AI, reading past papers' layouts, reading photo answers and marking written answers and 첨삭, checking recall attempts, writing and voicing podcast episodes, narrating notes, transcribing class recordings and files, tidying live words and finding memos in them, and drawing a visual overview an older app version asks for (2.11).
• When: at the moment you use one of those features, and as each part of a recording uploads.
• Retention: text requests not stored as conversation history; uploaded files deleted within about an hour; abuse-monitoring logs up to 30 days (Section 5.1).

Supadata (Dumpling Software UG (haftungsbeschränkt)) — Germany (Berlin); it uses providers in the EU and the United States.

• Data: the address of a YouTube video you add, with the language to fetch its subtitles in. Not your name, email, account ID or IP address: the request comes from our server.
• Purpose: fetching that video's title, length and subtitles, or, on Pro, for a video without subtitles, making a transcript from its sound; they become the source's text in your material.
• When: when you paste a YouTube link, to show the video, and when you add it.
• Retention: Supadata states that it keeps a record of each request (its endpoint, result and timing) while we are its customer, deletes a transcript's result an hour after making it, may cache the transcripts of public videos, and does not use what it processes to train AI models. None of it carries anything about you.

Soniox, Inc. — United States (Foster City, California).

• Data: the sound of a class you record or of your dictation, streamed from your device while live words are on, with a class's title, key terms from its set's notes, up to the last 500 characters of its words and the languages to expect, and your device's IP address (5.3).
• Purpose: writing the words as they are spoken.
• When: while you record a class with live words on, and while you dictate.
• Retention: Soniox states that real-time requests are not stored and are not used to train its models; it keeps usage records without the content.

Google LLC (Google Cloud) — United States company; our file converter runs in its Singapore region (asia-southeast1).

• Data: a PowerPoint or Word file you add (2.2).
• Purpose: converting it into a PDF.
• When: when you add such a file.
• Retention: none; the file is converted in a temporary folder that is removed when the conversion answers, and only its time and size are logged.

Mixpanel, Inc. — United States.

• Data: the analytics events, profile and technical data in 2.6, including the subscription events RevenueCat forwards, keyed to your account ID (or, for a class-link visitor without an account, a random identifier).
• Purpose: product analytics.
• When: as events happen while you use the app.
• Retention: up to 24 months, then deleted; earlier on request.

Functional Software, Inc. (Sentry) — United States.

• Data: the error reports in 2.7, keyed to your account ID.
• Purpose: diagnosing errors and crashes.
• When: when an error occurs.
• Retention: 90 days.

RevenueCat, Inc. — United States; subscriptions.

• Data: your account ID as the subscriber identifier and the subscription events in 2.12.
• Purpose: selling and managing StudyLess Pro on the App Store and Google Play, telling our server when your plan changes, and sending the subscription events to our Mixpanel project (2.6).
• When: in the mobile apps, each time the app starts with your account signed in and each time you sign in; in both apps, when you open the plan page, buy, restore or cancel; and on every renewal.
• Retention: for as long as the subscriber record exists. Deleting your account does not delete it there; we have it deleted when you ask.

Dodo Payments — the seller (merchant of record) of Pro bought on the web.

• Data: your account email, your name when we know it, your account ID, the plan with the price shown and the screen it was bought from, whether the student or someone else is paying, and your billing country (2.12); the payment details the payer enters on its checkout, which we never see; and, when someone else pays through your payment link, the email they enter.
• Purpose: selling Pro on the web: billing the payment, calculating and collecting sales tax or VAT, sending receipts, invoices and its own reminder before a trial's first charge, running the billing portal where a web subscription is cancelled, and telling our server about each subscription.
• When: when a checkout opens, on every renewal, when you open the billing portal from Settings, and when you delete your account, which cancels a web subscription (Section 9).
• Retention: Dodo Payments keeps its records of the purchase as the seller, under its own privacy policy.

Resend — United States; email delivery.

• Data: your account email and the message (2.5, 2.12); for an invite to a set, the address of the person invited and the invite (2.15).
• Purpose: sending the billing emails in 2.12 (the reminder before a free trial ends, the notice before a yearly plan renews and the notice when a payment fails), the study reminder email and the other notification emails in 2.5 (the weekly recap, exam-day and memo reminders, the pause email and class prompts), and invites to a set (2.15).
• When: three days before a trial ends, about 30 days before a yearly renewal, after a failed payment, on a day you have cards due and have not opened StudyLess (study reminder), at the times 2.5 gives for each other notification email, each only while that email is switched on, and when you invite someone to a set.
• Retention: Resend's own delivery records, for the period its service keeps them; we keep only when each email was sent.

Vercel, Inc. — United States.

• Data: the web app and this website are served from Vercel, so it sees the IP address and request metadata of every visit in its short-lived logs. The web app's AI requests (the material in 5.1, up to 20 MB each) and their replies pass through the web app's server at Vercel on their way to and from our server; our code there does not store or log them. On the website, the analytics in 2.10.
• Purpose: hosting; relaying the web app's AI requests; website analytics and performance measurement.
• When: on every visit to studyless.app or app.studyless.app, and each time the web app uses an AI feature.
• Retention: request logs for a short rolling window; website analytics as aggregated statistics.

Expo (650 Industries, Inc.) — United States.

• Data: your device's push token and the reminder message, when server-sent reminders are on (2.5).
• Purpose: delivering push notifications to Apple's and Google's push services.
• When: at the moment a reminder is sent. Currently off.
• Retention: transient delivery records.

Apple Inc. and Google LLC — United States.

• Data: if you use Sign in with Apple or Google, the provider handles your sign-in under its own privacy policy and tells us the identifier, email, name and (Google) profile picture address described in 2.1. Their push services carry reminder notifications to your device. The App Store and Google Play handle downloads and updates under their own terms, and sell Pro in the apps as the sellers, handling your payment under their own policies.

We may also disclose data when the law requires it (a court order or a lawful request from an authority), to protect the rights, safety or property of StudyLess, its users or others, or to detect and prevent fraud, abuse or security problems. If StudyLess is ever transferred to another operator (for example, a company set up to run it, or a sale), your data would move with it under this policy, and we would tell you before it happens.

7. Where your data goes (international transfers)

We operate from South Korea. Your data is stored in Singapore (Supabase on AWS) and processed by the providers named in Section 6, in the United States (among them Soniox, which receives the sound of a class streamed for live words, 5.3), by Supadata in Germany for the subtitles of a YouTube video you add (it receives only the video's address), by our file converter on Google Cloud in Singapore, and, for Pro bought on the web, by Dodo Payments. These countries may not offer the same legal protection as your own.

• EEA, UK and Switzerland: transfers rely on the providers' data processing agreements incorporating the European Commission's Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement, plus encryption in transit and at rest.
• South Korea: the transfers in Section 6 are necessary to provide the service you signed up for and are disclosed here with the recipient, country, timing, data, purpose and retention period, as PIPA Article 28-8 requires; each is sent over an encrypted network connection at the moment the feature that needs it runs. Providers are bound by contract to protect the data. You can refuse a transfer by not using the feature it serves (for example, live words: record without them, or do not dictate), and everything else works as before; refusing all of them means not using StudyLess, because storing your account is itself a transfer to Singapore.
• Brazil and other countries: the same contractual protections apply, together with any additional safeguards your local law requires.

Email support@studyless.app if you want a copy of the transfer safeguards for a specific provider.

8. How long we keep data

• Account, sign-in data and preferences: until you delete your account.
• Study material, extracted text, source summaries, notes, cards, sets and materials, review history, practice tests: until you delete the item or your account.
• Exams, the scores you enter, memos, recall checks, key terms and formulas, the text of each source, the record of material added: until you delete the item, its set or material, or your account.
• Photos of a written answer or of a page written for a recall check: not kept after they are read.
• A question you reported: with its practice test, until you delete that test or your account.
• Chats and their photos: until you delete the thread, its set or material, or your account; nothing expires them automatically. A chat or Ask AI answer kept for a retry: five minutes, and gone within about ten. The record of a free answer to a distress message: up to a week.
• 서술형 첨삭 and the text read from their photos, and retry rounds: until you delete them or your account.
• The 오답노트 and card game results: until you delete them, their set or material, or your account. Past-paper layouts: until you delete them or your account. The count of past-paper reads: two days.
• A 퀴즈 배틀's code: until the game ends, and at most two hours.
• Podcast episodes: until you delete the episode or your account.
• Visual overviews made before (2.11): until an older app version replaces one or you delete your account.
• Narration audio: until you delete your account. Rewriting the notes retires their narration, but today not its audio file.
• Files stored for a deleted material: deleting a material removes its records at once, but today not every file stored for it (uploaded files, card images, audio and pictures); those stay in storage until you delete your account.
• Interrupted generation drafts on your device: the source copies expire six hours after the generation started; the cards already produced stay until you save or discard them.
• Phone-photo links: a day after the link ends; their photos too, unless you added them to a material.
• Live words: with their recording, until you delete it, its source or your account. Records of live sessions and dictation (no words): until the recording or your account is deleted.
• Board photos: until you delete the memo, its material, its set or your account.
• Reminder settings and push tokens: until you turn reminders off, the token stops working, or you delete your account. Notification settings, the notification log and your answer to the question after an exam: until you delete your account.
• Your profile, nickname, preset avatar, time zone and minutes a day: until you delete your account. Your profile photo: until you remove it or delete your account. XP records, study days and timer blocks: until you delete your account.
• Friendships and requests: until either of you ends them, one blocks the other, or either account is deleted. Blocks: until you unblock or either account is deleted. Reports of an account: until either account is deleted.
• Classes, calendar items and to-dos: until you delete them or your account. The calendar link: until you make a new one, turn it off or delete your account.
• Class links: until you stop the link, delete the set or delete your account; the daily hashes that count opens without an account go as later opens are counted, and with the link. The record that a signed-in student opened a class link: until the link or that account is deleted. Invites: the address typed for an invite, 30 days from when it was sent (an unanswered invite goes with it); the rest of an invite until the set or the inviting account is deleted. Members: until the set is deleted, or the member leaves or is removed. The hash of an address that asked for no more invites: until that person asks us to remove it. The record of a set you added: until you delete that set or your account.
• Community listings: until you delete the set or your account (a listing you take down is kept, hidden, so you can publish it again). Publishers you blocked: until you unblock them or either account is deleted. Your acceptance of the community rules, and a ban from publishing: until your account is deleted (a ban also until it is lifted). The record that you opened a listed set: until that set or your account is deleted.
• Moderation records (each act on your listings, its reason and date): until your account is deleted; when the set is deleted, the record stays without the link to it, so a takedown still counts. Reports of a listed set: until the set or the reporting account is deleted.
• Feedback and support messages: while we work on them and for up to 24 months afterwards, in case the same issue comes back; deleted with your account when linked to it.
• Analytics (Mixpanel): up to 24 months from collection.
• Error reports (Sentry): 90 days.
• Rate-limit ledgers: for the window each one enforces — an hour, a day, or until the week or the calendar month ends — and then removed the next time your account makes a request that checks it, or when you delete your account. The count of a practice test's photo reads stays with that test.
• AI usage ledger: until you delete your account.
• The acquisition record and subscription records (2.6a, 2.12): until you delete your account.
• Server logs at hosting providers: short rolling windows set by the provider.
• Backups: rolling, expiring within 30 days.

Where the law requires us to keep something longer (for example, records of a dispute), we keep only what that obligation covers, for as long as it applies. When a retention period ends or its purpose is met, we delete the data: rows from the database and files from storage, which cannot be read back, and backups as they expire.

9. Deleting your account

Open Settings in the app or the web app, choose Delete account, and confirm by typing the confirmation word the screen shows (DELETE in English). You can also email support@studyless.app from the address on the account. Export your data first if you want to keep it; deletion cannot be undone.

Deletion runs immediately. It first cancels a Pro subscription bought on the web, so Dodo Payments never charges for it again, and then removes, in this order:

• your uploaded files and the originals of converted files, card images, lecture audio, board photos, chat photos, photos sent from a phone-photo link, narration and podcast audio, visual overviews, your profile photo and feedback screenshots from storage;
• any file still held at OpenAI on your behalf;
• your ledgers, lecture transcripts and live words, records of live sessions, notes, key terms and formulas, source material, the text of each source and source summaries, the record of material added, chats and their photos' records, answers kept for a retry, 첨삭 and the text read from their photos, podcast episodes, practice tests, the questions you reported and past-paper layouts, the 오답노트 and its retry rounds, card game results, 퀴즈 배틀 codes, your exams and the scores you entered, memos, recall checks, review history, cards, materials, sets, phone-photo links, share, class and payment links, invites and members of your sets, your community listings, your acceptance of the community rules, any ban, the moderation records of your listings, the record of community sets and class links you opened, the publishers you blocked, the reports you made, the record of sets you added, your profile, XP records, study days and timer blocks, friendships, requests, invite links, blocks and the reports that name you, classes, calendar items, to-dos and the calendar link, notification settings and the notification log, the acquisition record, your subscription and billing records (plan, Pro-day grants, subscription events, web subscriptions, trial reminders and old invite rows), feedback records, push subscriptions, Apple token and profile, including rows left by removed features;
• the account itself. If you signed in with Apple and we hold an Apple token for your account, we ask Apple to revoke the link between your Apple ID and StudyLess before anything is deleted.

What deletion does not reach on its own:

• database backups, which expire on their own within 30 days;
• OpenAI's abuse-monitoring logs, which expire within 30 days (Section 5.1);
• the analytics copy at Mixpanel: your profile (the per-account counts and flags in 2.6) is deleted at once, and we file an erasure request for the events keyed to your account ID in the same step, which Mixpanel completes on its side within about 30 days;
• the error reports at Sentry, which are keyed to your account ID and expire within 90 days (Section 8) — ask us and we will have them deleted sooner;
• the subscriber record at RevenueCat, keyed to your account ID, which we have deleted when you ask (Section 6);
• the purchase records Apple, Google and Dodo Payments keep as the sellers, under their own policies, and Resend's delivery record of an email;
• copies of your decks or sets that other people added from a link you sent, a class link, an invite or the community, which belong to their accounts (pictures in them that point at your images stop loading); their record of the addition stays with them, without your account;
• an invite someone sent to your email address before you had an account, which goes 30 days after it was sent;
• emails you sent to support, which we delete on request unless we need them for a dispute.

If a step fails (for example, our storage provider is unreachable), the app tells you the deletion did not complete and you can retry; we never report a deletion as done when it is not. Guest accounts from earlier versions have no email to recover with: once you sign out of a guest account, you cannot reach its data again.

10. Your rights and choices

Wherever you live, you can:

• See and take your data: the export in Settings (Export my data; Download my data in the web app) gives you one JSON file with your sets and materials (with their exams: days, scope, goals and the scores you entered), cards, notes (with their units, key terms and formulas), sources (their details, extracted text and the text of each page), source summaries, memos, review history, practice tests (with the questions you reported) and past papers' layouts, recall checks, 첨삭 with the text read from their photos, the 오답노트 with its retry rounds, the record of material added, chats, the scripts of your podcast episodes, the transcripts and live words of your recordings, your plan's marks and completed days, your calendar items, to-dos and timer blocks, your profile (nickname, avatar choice, who sees it, time zone, minutes a day, XP, level and streak) with your XP record and study days, card game results, the calendar link's record (never the link), your notification settings and the notifications decided for you, your community listings, your acceptance of the community rules, any ban, the moderation acts on your listings (act, reason and date), the community sets you opened, the reports you made of sets and of accounts (without either account's ID), the sets you added from others, when a phone last gave you its notices, your acquisition record, your first-run answers and your study counters, plus any work still waiting on that device to upload, and links that open the files you uploaded (your sources' files and photos, your cards' images, board photos and chat photos) and your profile photo for a week after the export. It does not contain audio or generated pictures (uploaded recordings, podcasts, narrations, visual overviews), the changes the chat suggested, your subscription and billing records, a few minutes' copies kept for a retry, or the lists that name other people or carry a live link (friends, requests, blocks, invites, members, class links and invite links); ask us for any of these.
• Correct it: edit cards, sets, materials and notes, your nickname, avatar and photo, your email and your password in the app.
• Delete it: delete individual sets, materials and cards, or your whole account (Section 9).
• Choose what others see: set your profile to nobody, friends or everyone; show your photo to friends or no one; leave the everyone leaderboards; stop a class link; withdraw an invite or remove a member; unpublish a set; block an account.
• Turn off usage analytics: Settings → Share usage analytics, in the app's settings. To object to crash reporting as well, or to have the Mixpanel and Sentry data already linked to your account ID deleted without deleting the account, email us.
• Control reminders and emails: turn each one off in Settings or with its email's unsubscribe link, or revoke the notification permission in your device settings.
• Ask us anything else about how your data is handled, including asking us to restrict a particular use.

Region-specific notes

• EEA, UK, Switzerland: you also have the rights to restriction and portability, to object to processing based on legitimate interests, and to complain to your data protection authority (in the UK, the ICO). We would rather hear from you first, but that is your right.
• California and other US states: you have the rights to know, access, correct and delete, and not to be discriminated against for using them. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics about you, so there is nothing to opt out of.
• Brazil: you have the rights listed in Article 18 LGPD, including confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, and information about the entities we share data with (Section 6).
• South Korea: you may request access, correction, deletion and suspension of processing under PIPA, and you may contact the Personal Information Protection Commission's report centre (privacy.go.kr, 118) if you believe we have not handled your data properly.
• Japan: you may request disclosure, correction, suspension of use and deletion of your retained personal data under the APPI.

How to exercise a right

Use the in-app features above, or email support@studyless.app from the email address on your account. If we cannot tell it is you, we will ask you to confirm from that address or to send something only the account holder would know. We answer within the time the applicable law allows — normally within 30 days, and sooner when we can. There is no charge.

11. Security

• All traffic between your device, our servers and our providers is encrypted (TLS). Data at rest is encrypted by our hosting provider.
• Every table holding your data has row-level access rules, so a signed-in account can only read and write its own rows. Your source files sit in a folder only your account can read. What other people see of you and your sets (2.13–2.16) is read only through a few narrow database functions that return the fields listed there and nothing else; a visitor without an account reaches a class link only through our server, which returns the same narrow view.
• Provider keys (OpenAI, Soniox, push, Apple) exist only on our server, never in the app. Passwords are stored as hashes; Apple refresh tokens are encrypted.
• Analytics and error reports are scrubbed in code before they leave the device, and the rules are tested on every change.

Three limits are worth knowing. Card images are reachable by anyone with their exact link (Section 2.2). A class link and the calendar link let anyone who holds them read what they show (2.14, 2.15), so give them only to people you mean to. And no system is perfectly secure: if we ever learn of a breach affecting your data, we will tell you and the relevant authorities as the law requires.

12. Cookies and storage on your device

• Web app (app.studyless.app): your sign-in session and analytics identifier are kept in your browser's local storage; a copy of your library and pending changes is kept in IndexedDB so the app works offline; a small cookie remembers your language (studyless-lang); a 퀴즈 배틀 player's seat is kept in the tab's session storage. None of these are used for advertising.
• Mobile apps: your session, library, settings and cached source files are stored in the app's own storage on the device and removed when you sign out or uninstall.
• This website: no advertising or tracking cookies; the Vercel analytics in 2.10 are cookieless. The campaign tags of the link you arrived through are kept in the tab's session storage so the site's links can pass them on to the stores and the web app, and the contact form keeps the time you last sent a message in local storage to prevent repeated sends.

Clearing your browser storage or uninstalling the app signs you out and removes the local copy; your account data stays on our servers until you delete it.

13. Links to other services

StudyLess links to our Discord community, to the App Store and Google Play, and to Dodo Payments' checkout and billing portal, and your calendar app reads the calendar link if you add it there. Those services have their own privacy practices, which we do not control.

14. Changes to this policy

When we change how we handle data, we update this page and its effective date first. For changes that matter to you — a new provider, a new kind of data, a new purpose — we also tell you in the app or by email before the change takes effect, and where the law requires your consent we ask for it rather than assume it. Continuing to use StudyLess after a change does not, by itself, mean you agreed to anything that needed your consent. This policy is published in English and in Korean; if the two ever differ, the Korean text governs for users in South Korea and the English text everywhere else.

Change history

• October 25, 2026: the overhaul, and a Korean text of this policy. Sets and materials in place of folders and decks; chat threads and chat photos; 서술형 첨삭; the 오답노트 and its retry rounds; past-paper layouts for 기출 참고; a question you report and our reading of it; card games and 퀴즈 배틀; the phone-photo link, PowerPoint and Word files converted on Google Cloud (Singapore), and Quizlet and Anki imports; a chat or Ask AI answer kept five minutes for a retry. Your profile (a nickname, a preset avatar, an optional profile photo, shown to your friends only if you choose, who can see it, your time zone and minutes a day), XP and levels, the streak and the study timer; friends, blocks, reports and leaderboards (friends by default; the everyone boards only if you join); classes, class prompts and a private calendar link; notification emails beside the study reminder (the weekly recap, exam-day and memo reminders, the pause email and class prompts) and the one question after an exam; sharing a set by class link or invite, with its practice tests' questions and their answers, and invite addresses deleted after 30 days; the community, which you join set by set, with its automatic check, reports and takedowns; live words and dictation through Soniox (United States), which keeps nothing; board photos; what the feedback form attaches; the two questions after sign-up; the Google profile picture, shown only to you; how to refuse an overseas transfer.
• October 20, 2026: exam prep: the tests you set up and the scores you enter, recall checks (their photos not kept), memos, and the plan's quizzes and mock exams by step, with written answers marked per criterion and photos of written answers read into text (not kept); material added to a deck; the text of each page of your sources, kept for Ask AI and the chat; key terms and formulas; YouTube links, whose subtitles Supadata (Germany) fetches from the video's address alone; recordings in 15-second parts with your ★ marks, and lecture files on the phone and the web; analytics for exam prep, which never carries a test's date, your goal or the score you enter; the current apps no longer make visual overviews; review answers are Forgot or Got it.
• October 17, 2026: Pro is sold on the web again, so Dodo Payments is named as the seller (merchant of record) of Pro bought on the web, with what it receives at checkout (your account email, your name when we know it, your account ID and plan, and your billing country) and what we keep (each web subscription's and customer's IDs, product, status, billing dates and whether it is set to cancel, and the events Dodo sends us); deleting your account now cancels a web subscription at once; the payment link is offered again; corrected the trial reminder email to three days before a trial ends.
• October 8, 2026: Pro is bought only in the iPhone and Android apps, so Paddle is no longer named (it never took a real payment for StudyLess); the billing emails through Resend now cover every store's trial reminder and add a notice before a yearly plan renews (with two counts from your account) and one when a payment fails; described the record kept when you take the cancel screen's seven more free days; the payment link is offered only while Pro is sold on the web.
• October 2, 2026: stated that our server, as well as RevenueCat, records in Mixpanel when Pro starts and the plan on your profile, and that the usage-analytics switch does not stop these server copies.
• September 26, 2026: corrected descriptions to match the current apps: named Paddle (the seller of Pro bought on the web, which receives the account email) and Resend (the trial reminder email, while it is switched on); described the deck chat and its history, podcast episodes, visual overviews, source summaries, the change you ask for in a notes rewrite, and the acquisition record written at sign-in; listed every purpose we use OpenAI for and which requests carry its storage setting; added the plan and campaign details in analytics and the subscription events RevenueCat forwards to Mixpanel, and removed a profile field that does not exist; stated that the web app's AI requests pass through its server at Vercel and that the phone apps contact RevenueCat at start-up and sign-in; corrected the export (one JSON file, with what it leaves out), the deletion list, the Apple disconnection (when we hold an Apple token), the retention of rate-limit rows, drafts, narration audio and a deleted deck's files, what a sent copy carries, and the billing-records statement; described the website's session and local storage.
• September 24, 2026: corrected descriptions to match the current apps: decks sit in folders instead of inside other decks; the deck summary is now called notes, and a copy of a deck includes them; answer checks and the invite programme are no longer offered; allowances depend on your plan; the deletion list names notes, folders, share and payment links, narration audio and lecture audio; a recorded lecture's audio is kept in your account, in 30-second parts, until you delete the recording, its source or your account (it was described as deleted after transcription), and OpenAI's entry names the lecture audio it transcribes; removed a cookie the web app no longer sets and internal version numbers.
• September 14, 2026: rewritten to match StudyLess 2.0: added mock exams, stored extracted text, reminder settings and push tokens, feedback screenshots, the AI usage ledger and the public-link note for card images; named Vercel and Expo; corrected Supabase's hosting region to Singapore; described immediate account deletion and what it does not reach; removed streaks, daily goals and avatars, which no longer exist; named the privacy officer under PIPA and corrected the legal bases. The same day, feedback screenshots were made private, unauthenticated access to the old public deck library was closed, and the usage-analytics switch was added.
• August 16, 2026: corrected the AI provider from Google (Gemini API) to OpenAI, which it had been in practice, and described retention and training handling.

15. Contact

Questions, requests, or something that looks wrong: support@studyless.app. Postal correspondence can be arranged through that address. For how to delete your account from outside the app, see Delete your account. Our Terms of Service cover the rest of the relationship.